Bill Text: FL S0242 | 2014 | Regular Session | Comm Sub

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Security of a Protected Consumer's Information

Spectrum: Slight Partisan Bill (? 3-1)

Status: (Passed) 2014-06-13 - Chapter No. 2014-66 [S0242 Detail]

Download: Florida-2014-S0242-Comm_Sub.html

---

       Florida Senate - 2014                              CS for SB 242
       
       
        
       By the Committee on Commerce and Tourism; and Senator Detert
       
       
       
       
       
       577-00605-14                                           2014242c1
    1                        A bill to be entitled                      
    2         An act relating to the security of a protected
    3         consumer’s information; providing a short title;
    4         creating s. 501.0051, F.S.; providing definitions;
    5         authorizing the representative of a protected consumer
    6         to place a security freeze on a protected consumer’s
    7         consumer report or record; specifying the procedure to
    8         request a security freeze; requiring a consumer
    9         reporting agency to establish a record if the
   10         protected consumer does not have an existing consumer
   11         report; prohibiting the use of a consumer record for
   12         certain purposes; requiring a consumer reporting
   13         agency to place, and to provide written confirmation
   14         of, a security freeze within a specified period;
   15         prohibiting a consumer reporting agency from stating
   16         or implying that a security freeze reflects a negative
   17         credit history or rating; requiring a consumer
   18         reporting agency to provide a copy of a consumer
   19         report or record to a protected consumer or his or her
   20         representative upon request; authorizing a consumer
   21         reporting agency to charge a fee for a copy of a
   22         protected consumer’s consumer report or record;
   23         specifying the procedure to request a copy of a
   24         protected consumer’s consumer report or record;
   25         requiring a consumer reporting agency to remove a
   26         security freeze under specified conditions; specifying
   27         the procedure to remove a security freeze; providing
   28         applicability; authorizing a consumer reporting agency
   29         to charge a fee for placing or removing a security
   30         freeze and for reissuing a unique personal identifier;
   31         prohibiting a fee under certain circumstances;
   32         requiring written notification upon the change of
   33         specified information in a protected consumer’s
   34         consumer report or record; providing exceptions;
   35         requiring a consumer reporting agency to notify a
   36         representative and provide specified information if
   37         the consumer reporting agency violates a security
   38         freeze; providing penalties and civil remedies;
   39         providing written disclosure requirements for consumer
   40         reporting agencies relating to a protected consumer’s
   41         security freeze; providing an effective date.
   42          
   43  Be It Enacted by the Legislature of the State of Florida:
   44  
   45         Section 1. This act may be cited as the “Keeping I.D. Safe
   46  (KIDS) Act.”
   47         Section 2. Section 501.0051, Florida Statutes, is created
   48  to read:
   49         501.0051 Protected consumer report security freeze.—
   50         (1) As used in this section, the term:
   51         (a) “Consumer report” has the same meaning as provided in
   52  15 U.S.C. s. 1681a(d).
   53         (b) “Consumer reporting agency” has the same meaning as
   54  provided in 15 U.S.C. s. 1681a(f).
   55         (c) “Protected consumer” means a person younger than 16
   56  years of age at the time a security freeze request is made or a
   57  person represented by a guardian or other advocate pursuant to
   58  chapter 39, chapter 393, chapter 744, or chapter 914.
   59         (d) “Record” means a compilation of information that:
   60         1. Identifies a protected consumer; and
   61         2. Is created by a consumer reporting agency exclusively
   62  for the purpose of complying with this section.
   63         (e) “Representative” means the custodial parent or legal
   64  guardian of a protected consumer, including a guardian appointed
   65  pursuant to s. 914.17.
   66         (f) “Security freeze” means:
   67         1. A notice placed on a protected consumer’s consumer
   68  report which prohibits a consumer reporting agency from
   69  releasing the consumer report, the credit score, or any
   70  information contained within the consumer report to a third
   71  party without the express authorization of the representative;
   72  or
   73         2. If a consumer reporting agency does not have a consumer
   74  report pertaining to the protected consumer, a notice placed on
   75  the protected consumer’s record which prohibits the consumer
   76  reporting agency from releasing the protected consumer’s record
   77  except as provided in this section.
   78         (g) “Sufficient proof of authority” means documentation
   79  showing that a representative has authority to act on behalf of
   80  a protected consumer. The term includes, but is not limited to,
   81  a court order, a copy of a valid power of attorney, or a written
   82  notarized statement signed by a representative which expressly
   83  describes the authority of the representative to act on behalf
   84  of the protected consumer.
   85         (h) “Sufficient proof of identification” means
   86  documentation identifying a protected consumer or a
   87  representative of a protected consumer. The term includes, but
   88  is not limited to, a copy of a social security card, a certified
   89  or official copy of a birth certificate, a copy of a valid
   90  driver license, or a copy of a government-issued photo
   91  identification.
   92         (2) A representative may place a security freeze on a
   93  protected consumer’s consumer report by:
   94         (a) Submitting a request to a consumer reporting agency in
   95  the manner prescribed by that agency;
   96         (b) Providing the agency with sufficient proof of authority
   97  and sufficient proof of identification of the representative;
   98  and
   99         (c) Paying the agency a fee as authorized under this
  100  section.
  101         (3) If a consumer reporting agency does not have a consumer
  102  report pertaining to a protected consumer when the consumer
  103  reporting agency receives a request for a security freeze under
  104  subsection (2), the consumer reporting agency shall create a
  105  record for the protected consumer and place a security freeze on
  106  the record. A record may not be created or used to consider the
  107  protected consumer’s credit worthiness, credit standing, credit
  108  capacity, character, general reputation, personal
  109  characteristics, or eligibility for other financial services.
  110         (4) A consumer reporting agency shall place a security
  111  freeze on a consumer report or record within 30 days after
  112  confirming the authenticity of a security freeze request made in
  113  accordance with this section.
  114         (5) The consumer reporting agency shall send a written
  115  confirmation of the security freeze to the representative within
  116  10 business days after instituting the security freeze on the
  117  consumer report or record and shall provide the representative
  118  with instructions for removing the security freeze and a unique
  119  personal identifier to be used by the representative when
  120  providing authorization for removal of the security freeze.
  121         (6) A consumer reporting agency may not state or imply to
  122  any person that a security freeze reflects a negative credit
  123  score, a negative credit history, or a negative credit rating.
  124         (7) During any period that a security freeze is in effect,
  125  a consumer reporting agency shall provide a copy of a protected
  126  consumer’s consumer report or record to the protected consumer
  127  or his or her representative upon request. A consumer reporting
  128  agency may charge the representative or protected consumer a fee
  129  for the copy, not to exceed the amount normally charged by such
  130  agency to provide a copy of a consumer report.
  131         (a) A representative submitting a request for a copy of a
  132  protected consumer’s consumer report or record must provide all
  133  of the following:
  134         1. Sufficient proof of identification of the representative
  135  and sufficient proof of authority as determined by the consumer
  136  reporting agency.
  137         2. The unique personal identifier provided by the consumer
  138  reporting agency pursuant to subsection (5).
  139         3. A fee as authorized under this section.
  140         (b) A protected consumer submitting a request for a copy of
  141  his or her consumer report or record must provide sufficient
  142  proof of identification of the protected consumer as determined
  143  by the consumer reporting agency and pay a fee as authorized
  144  under this section.
  145         (8) A consumer reporting agency shall remove a security
  146  freeze from a protected consumer’s consumer report or record
  147  only under either of the following circumstances:
  148         (a) Upon the request of a representative or a protected
  149  consumer. A consumer reporting agency shall remove a security
  150  freeze within 30 days after receiving such a request for removal
  151  from a protected consumer or his or her representative.
  152         1. A representative submitting a request for removal must
  153  provide all of the following:
  154         a. Sufficient proof of identification of the representative
  155  and sufficient proof of authority as determined by the consumer
  156  reporting agency.
  157         b. The unique personal identifier provided by the consumer
  158  reporting agency pursuant to subsection (5).
  159         c. A fee as authorized under this section.
  160         2. A protected consumer submitting a request for removal
  161  must provide all of the following:
  162         a. Sufficient proof of identification of the protected
  163  consumer as determined by the consumer reporting agency.
  164         b. Documentation that the sufficient proof of authority of
  165  the protected consumer’s representative to act on behalf of the
  166  protected consumer is no longer valid.
  167         c. A fee as authorized under this section.
  168         (b) If the security freeze was instituted due to a material
  169  misrepresentation of fact. If a consumer reporting agency
  170  intends to remove a security freeze under this paragraph, the
  171  consumer reporting agency must notify the representative and
  172  protected consumer in writing before removing the security
  173  freeze.
  174         (9) This section does not apply to the use of a protected
  175  consumer’s consumer report or record by the following persons or
  176  for the following reasons:
  177         (a) A state agency acting within its lawful investigative
  178  or regulatory authority.
  179         (b) A state or local law enforcement agency investigating a
  180  crime or conducting a criminal background check.
  181         (c) A person administering a credit file monitoring
  182  subscription service to which the protected consumer or the
  183  representative, on behalf of the protected consumer, has
  184  subscribed.
  185         (d) A person providing the protected consumer’s consumer
  186  report or record to the protected consumer or the representative
  187  upon the request of the protected consumer or representative.
  188         (e) Pursuant to a court order lawfully entered.
  189         (f) An insurance company for use in setting or adjusting a
  190  rate, adjusting a claim, or underwriting for insurance purposes.
  191         (g) A consumer reporting agency’s database or file that
  192  consists entirely of information concerning, and used
  193  exclusively for, one or more of the following:
  194         1. Criminal record information.
  195         2. Personal loss history information.
  196         3. Fraud prevention or detection.
  197         4. Tenant screening.
  198         5. Employment screening.
  199         6. Personal insurance policy information.
  200         7. Noncredit information used for insurance purposes.
  201         (h) A check services company issuing authorizations for the
  202  purpose of approving or processing negotiable instruments,
  203  electronic funds transfers, or similar methods of payment.
  204         (i) A deposit account information service company issuing
  205  reports regarding account closures due to fraud, substantial
  206  overdrafts, automatic teller machine abuse, or similar negative
  207  information regarding a protected consumer to an inquiring
  208  financial institution, as defined in s. 655.005 or in federal
  209  law, for use only in reviewing a representative’s request for a
  210  deposit account for the protected consumer at the inquiring
  211  financial institution.
  212         (j) A consumer reporting agency that acts only as a
  213  reseller of credit information by assembling and merging
  214  information contained in the database of another consumer
  215  reporting agency or multiple consumer reporting agencies and
  216  that does not maintain a permanent database of credit
  217  information from which new consumer reports are produced.
  218  However, such consumer reporting agency shall honor any security
  219  freeze placed or removed by another consumer reporting agency.
  220         (k) A fraud prevention services company issuing reports to
  221  prevent or investigate fraud.
  222         (l) A person or entity, or its affiliates, or a collection
  223  agency acting on behalf of the person or entity and with which
  224  the protected consumer has an existing account, requesting
  225  information in the protected consumer’s consumer report or
  226  record for the purposes of reviewing or collecting the account.
  227  Reviewing the account includes activities related to account
  228  maintenance, monitoring, credit line increases, and account
  229  upgrades and enhancements.
  230         (10)(a) A consumer reporting agency may charge a reasonable
  231  fee, not to exceed $10, to place or remove a security freeze.
  232         (b) A consumer reporting agency may charge a reasonable
  233  fee, not to exceed $10, if the representative fails to retain
  234  the original unique personal identifier provided by the consumer
  235  reporting agency and the agency must reissue the unique personal
  236  identifier or provide a new unique personal identifier to the
  237  representative.
  238         (c) A consumer reporting agency may not charge a fee under
  239  this section to the representative of a protected consumer who
  240  is a victim of identity theft if the representative submits, at
  241  the time the security freeze is requested, a copy of a valid
  242  investigative report, an incident report, or a complaint with a
  243  law enforcement agency about the unlawful use of the protected
  244  consumer’s identifying information by another person.
  245         (11) If a security freeze is in effect, a consumer
  246  reporting agency must send written confirmation to a protected
  247  consumer’s representative of a change to any of the following
  248  official information in the protected consumer’s consumer report
  249  or record within 30 days after the change is posted:
  250         (a) The protected consumer’s name.
  251         (b) The protected consumer’s address.
  252         (c) The protected consumer’s date of birth.
  253         (d) The protected consumer’s social security number.
  254  
  255  Written confirmation is not required for technical corrections
  256  of a protected consumer’s official information, including name
  257  and street abbreviations, complete spellings, or transposition
  258  of numbers or letters. In the case of an address change, the
  259  written confirmation must be sent to the representative and to
  260  the protected consumer’s new address and former address.
  261         (12) If a consumer reporting agency violates a security
  262  freeze placed in accordance with this section by releasing
  263  information subject to a security freeze without proper
  264  authorization, the consumer reporting agency shall, within 5
  265  business days after discovering or being notified of the release
  266  of information, notify the representative of the protected
  267  consumer in writing. The notice shall state the specific
  268  information released and provide the name, address, and other
  269  contact information of the recipient of the information.
  270         (13) A consumer reporting agency that willfully fails to
  271  comply with any requirement imposed under this section is
  272  subject to an administrative fine in the amount of $500, imposed
  273  by the Department of Agriculture and Consumer Services pursuant
  274  to the administrative procedures established in chapter 120.
  275         (14) In addition to any other penalties or remedies
  276  provided under law, the following persons who are aggrieved by a
  277  violation of this section may bring a civil action as follows:
  278         (a) A person who obtains a protected consumer’s consumer
  279  report or record from a consumer reporting agency under false
  280  pretenses or who knowingly obtains a protected consumer’s
  281  consumer report or record without a permissible purpose is
  282  liable to the representative and protected consumer for actual
  283  damages sustained by the protected consumer or $1,000, whichever
  284  is greater.
  285         (b) A person who obtains a protected consumer’s consumer
  286  report or record from a consumer reporting agency under false
  287  pretenses or who knowingly obtains a protected consumer’s
  288  consumer report or record without a permissible purpose is
  289  liable to the consumer reporting agency for actual damages
  290  sustained by the consumer reporting agency or $1,000, whichever
  291  is greater.
  292         (15) A written disclosure by a consumer reporting agency,
  293  pursuant to 15 U.S.C. s. 1681g, to a representative and
  294  protected consumer residing in this state must include a written
  295  summary of all rights that the representative and protected
  296  consumer have under this section and, in the case of a consumer
  297  reporting agency that compiles and maintains records on a
  298  nationwide basis, a toll-free telephone number that the
  299  representative can use to communicate with the consumer
  300  reporting agency. The information provided in paragraph (b) must
  301  be in at least 12-point boldfaced type. The written summary of
  302  rights required under this section is sufficient if it is
  303  substantially in the following form:
  304         (a) If you are the custodial parent or legal guardian of a
  305  minor younger than 16 years of age or a guardian or advocate of
  306  an incapacitated, disabled, or protected person under chapter
  307  39, chapter 393, chapter 744, or chapter 914, Florida Statutes,
  308  you have the right to place a security freeze on the consumer
  309  report of the person you are legally authorized to care for. If
  310  no consumer report exists, you have the right to request that a
  311  record be created and a security freeze be placed on the record.
  312  A record with a security freeze is intended to prevent the
  313  opening of credit accounts until the security freeze is removed.
  314         (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
  315  CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN A
  316  CONSUMER REPORT OR RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT
  317  THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION
  318  REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT
  319  SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT,
  320  LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET
  321  CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN
  322  EXTENSION OF CREDIT AT POINT OF SALE.
  323         (c) To remove the security freeze on the protected
  324  consumer’s record or report, you must contact the consumer
  325  reporting agency and provide all of the following:
  326         1. Proof of identification as required by the consumer
  327  reporting agency.
  328         2. Proof of authority over the protected consumer as
  329  required by the consumer reporting agency.
  330         3. The unique personal identifier provided by the consumer
  331  reporting agency.
  332         4. Payment of a fee.
  333         (d) A consumer reporting agency must, within 30 days after
  334  receiving the above information, authorize the removal of the
  335  security freeze.
  336         (e) A security freeze does not apply to a person or entity,
  337  or its affiliates, or a collection agency acting on behalf of
  338  the person or entity and with which the protected consumer has
  339  an existing account, which requests information in the protected
  340  consumer’s consumer report or record for the purposes of
  341  reviewing or collecting the account. Reviewing the account
  342  includes activities related to account maintenance, monitoring,
  343  credit line increases, and account upgrades and enhancements.
  344         (f) You have the right to bring a civil action as
  345  authorized by section 501.0051, Florida Statutes, which governs
  346  the security of protected consumer information.
  347         Section 3. This act shall take effect September 1, 2014.
  348